A United States judge approved Viacom’s request for YouTube to turn over its private user data. This is part of the $1 billion copyright infringement lawsuit Viacom filed against the online video service. Viacom, who owns Paramount and MTV, is suing YouTube owner Google for letting its users upload and watch copyrighted material from its movie and TV studios.

Judge Louis Stanton of the United States District Court for the Southern District of New York ordered on Tuesday that Google turn over parts of the YouTube user database, which will be used as evidence in the lawsuit. This includes all the usernames of both uploaders and viewers, what videos they uploaded and watched, and all the computer addresses of those who visited the site.

YouTube users who wanted to upload their amateur videos or view mature content had to signup for an account. Users who signed up for an account (including yours truly) had inputted personally identifiable information in the process. As for those who opted not have user accounts, their IP address logs are going to be included in the submitted data.

Viacom needs the data in order for them to prove how often their videos are watched compared to the amateur videos on the site. That data could possibly prove that copyright-protected content helps draw internet users to the video sharing site – which means that Google is drawing up financial gains from online video piracy.

Needless to say, this has sparked outrage from privacy advocates; like those who belong to the Electronic Frontier Foundation. According to their blog, this recent court order violated the Video Privacy Protection Act (VPPA). The VPPA was passed by the United States Congress in 1988, signed into law by then President Reagan. It was created to prevent “wrongful disclosure of video tape rental or sale records” – which in a way is the same as ordering Google to divulge online video viewership and other habits.

Although further data is needed to personally identify IP addresses (like for example the matching database from the user’s ISP or Internet Service Provider), some analyst believe that this initial action imposed on one of the biggest internet communities could be the spark of widespread exposes of confidential online data.

“On the surface, it looks like the IP address is not personally identifiable,” said Larry Ponemon of the Ponemon Institute, a research firm in Michigan that studies privacy issues. “But it could in fact haunt you in the future.”

“We realize that there’s this giant vault of private information held by Google and YouTube and other companies, and [the court order] makes very clear that any federal judge in the country can order access to it,” says Columbia Law School professor Tim Wu, co-author of the book “Who Controls the Internet?” “The stuff people look for when they’re online is pretty embarrassing, about the most revealing stuff.”

Google wants to assure the public that they are doing their best to comply with the court order whilst keeping personal data secure. Google senior litigation counsel Catherine Lacavera said, “We are disappointed the court granted Viacom’s overreaching demand for viewing history. We will ask Viacom to respect users’ privacy and allow us to anonymise the logs before producing them under the court’s order.”

Google intends to be cooperative but will have to protect their users by “carving out some space for user privacy,” said Lacavera. Anonymising the data means omitting usernames and computer addresses in the soon to be submitted database.

Thankfully, Viacom is in the same page as Google:

“Viacom has not asked for and will not be obtaining any personally identifiable information of any user,” said their rep. “Any information that we or our outside advisors obtain… will be used exclusively for the purpose of proving our case against YouTube and Google (and) will be handled subject to a court protective order and in a highly confidential manner.”

The court did not allow Viacom to access YouTube’s search technology or the users’ private videos – which, although could be helpful in their cause, is not part of the major data needed in the first place.

In fairness to the judge’s ruling, most users do not actually divulge personal info when creating online accounts unless it is necessary. Also aside from having the need to match IP addresses from the ISP, not all IP addresses are fixed, some are assigned as you connect – like for example those from a Wi-Fi hotspot, an internet café, or even from an office network.

But the bad news remains for those who do have a static IP, and more so for those who used their real names when they signed up. The court order seems to have taken this fact for granted. Even though it can be argued that this comprises a minimal percentage of the total data to be submitted (which is still in itself debatable), the court order still undermines the privacy of these individuals.